CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52509 – Nextcloud Mail app does not respect download permissions in shares
https://notcve.org/view.php?id=CVE-2024-52509
15 Nov 2024 — Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2. • https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8b • CWE-284: Improper Access Control •
CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2024-52508 – Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers
https://notcve.org/view.php?id=CVE-2024-52508
15 Nov 2024 — Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0. • https://github.com/nextcloud/mail/commit/a84c70e15d814dab6f0e8eda71bbaaf48152079b • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 1CVE-2024-52510 – Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
https://notcve.org/view.php?id=CVE-2024-52510
15 Nov 2024 — The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later. • https://github.com/d-xuan/CVE-2024-52510 • CWE-295: Improper Certificate Validation •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52507 – Share information of the Nextcloud Tables app is not limited to affected users
https://notcve.org/view.php?id=CVE-2024-52507
15 Nov 2024 — Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rgvc-xr2w-qq45 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52511 – Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables
https://notcve.org/view.php?id=CVE-2024-52511
15 Nov 2024 — Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4qqp-9h2g-7qg7 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40636 – Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness
https://notcve.org/view.php?id=CVE-2024-40636
17 Jul 2024 — Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry, an error is logged with the Eureka server service URLs but only the first URL is masked. The code in question is `_logger.LogError(e, ... • https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-vmcp-66r5-3pcp • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37886 – Nextcloud user_oidc's ID4me does not validate signature or expiration
https://notcve.org/view.php?id=CVE-2024-37886
14 Jun 2024 — user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0. La aplicación user_oidc es un backend de usuario de OpenID Connect para Nextcloud. Un atacante podría engañar a la aplicación para que acepte una solicitud que no esté firmada por el servidor correcto. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw5h-29xf-g55g • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37885 – Code injection in Nextcloud Desktop Client for macOS
https://notcve.org/view.php?id=CVE-2024-37885
14 Jun 2024 — The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0. Nextcloud Desktop Client es una herramienta para sincronizar archivos desde Nextcloud Server con su computadora. Una inyección de código en Nextcloud Desktop Client para macO... • https://github.com/nextcloud/desktop/pull/6378 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2024-37883 – Nextcloud Deck can access comments and attachments of deleted cards
https://notcve.org/view.php?id=CVE-2024-37883
14 Jun 2024 — Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1. Nextcloud Deck es una herramienta de organización estilo kanban destinada a la planificación personal y organización de proyectos para equipos integrada... • https://github.com/nextcloud/deck/pull/5423 • CWE-284: Improper Access Control •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37312 – Nextcloud user_oidc app's ID4me feature is available even when disabled
https://notcve.org/view.php?id=CVE-2024-37312
14 Jun 2024 — user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28). La aplicación user_oidc es un backend de usuario de OpenID Connect para Nextcloud. La falta de control de acceso en el terminal ID4me permite ... • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q • CWE-284: Improper Access Control •